Notifications
Clear all
Topic starter
18/08/2026 2:33 pm
TL;DR: AI can accelerate COBOL understanding, translation, and test generation, but Sonar argues that the real bottleneck is verifying whether output preserves business logic and control integrity across load-bearing systems. The practical shift is toward deterministic code analysis that treats human-written and AI-generated COBOL with the same gate.
NHIMG editorial — based on content published by Sonar: AI-assisted COBOL modernization and the need for verification
Questions worth separating out
Q: What breaks when AI-generated COBOL is not independently verified?
A: The failure mode is behavioural drift.
Q: Why does COBOL modernization create a verification problem instead of just a translation problem?
A: Because the hardest part of legacy modernization is preserving intent, not converting syntax.
Q: How do organisations know whether AI-assisted code remediation is actually safe?
A: They know it is safe only when every automated fix is reviewed, tested, and traceable back to the original finding.
Practitioner guidance
- Implement deterministic quality gates Require AI-generated COBOL and human-authored COBOL to pass the same static analysis, policy checks, and fail conditions before promotion to production.
- Capture business rules before retirement Document critical COBOL logic while subject-matter experts are still available, then validate AI translations against those preserved business rules.
- Separate draft generation from release authority Allow agents to produce first drafts and refactor candidates, but keep release authority with a controlled review step that can block behavioural drift.
What's in the full article
Sonar's full analysis covers the operational detail this post intentionally leaves for the source:
- COBOL analysis coverage across SonarQube Server Enterprise Edition and SonarQube Cloud Enterprise plan
- Nearly 200 rules across 10 COBOL dialects, including embedded DB2 SQL and CICS statements
- How quality gates compare human-written and AI-generated code on the same pass-or-fail criteria
- In-editor feedback through SonarQube for IDE in connected mode for day-to-day development workflows
👉 Read Sonar's analysis of AI-assisted COBOL modernization and verification →
AI-generated COBOL code: where verification becomes the control point?
Explore further
18/08/2026 3:20 pm
Verification debt is the real modernization risk. AI lowers the cost of understanding and rewriting old code, but it also increases the volume of changes that require independent checking. When review capacity shrinks faster than change volume grows, organisations accumulate verification debt. That debt is more dangerous than technical debt in load-bearing systems because it delays the discovery of behavioural drift until it is already in production. The practitioner conclusion is straightforward: if you cannot verify at the rate you generate, you cannot safely modernize.
A question worth separating out:
Q: Who is accountable when an AI system changes infrastructure configuration?
A: Accountability should sit with the programme owner responsible for the AI system and the change governance process that approved its operating scope. If the system can alter configuration, then the access model, logging model, and change approval model all need explicit ownership, otherwise responsibility becomes distributed until no one can defend the outcome.
👉 Read our full editorial: AI-assisted COBOL modernization depends on verification, not generation
